Best practices for creating effective DR documentation

1. Best practices for creating effective DR documentation A DRP is only as strong as it’s documentation. Create visual-based documentation to improve usability and effectiveness.

2. More and more organizations are starting to recognize that the traditional DRP manual is not practical DRPs are often created to satisfy auditors or business leaders who insist (rightly so) on having a recovery plan in place. However, this has led to lengthy overly-detailed documentation that is geared to auditors and business leaders, not IT staff trying to execute a recovery in a high-pressure, time-sensitive scenario. Organizations are recognizing that the traditional DRP is not practical in a crisis. Staff don’t have time to flip through a 300-page manual, let alone read lengthy instructions, so organizations are transforming monster manuals into shorter, visual-based documentation. Regardless of company size, 42-45% have abandoned traditional DRP manuals The trend away from traditional manuals is consistent globally Primarily a traditional manual 58% 58% Primarily checklists,  55% 54% diagrams, and flowcharts 46% 45% 42% 42% Source: Info-Tech Research Group, N=78 Small-Mid (up to 1,000 FTEs) Large (1,001+ FTEs) North America Europe and Asia We did some walkthroughs based on our 4-binder DRP, and found it was unworkable. We’re now 90 percent of the way through translating that into a single-page, quick reference sheet for each staff member with their specific instructions. – Rik Toms, Head of Strategy - IP and IT, Cable and Wireless Communications

3. Create visual-based documentation to improve usability and effectiveness Choose flowcharts over process guides, checklists over procedures, and diagrams over descriptions If you need a three-inch binder to hold your DRP, imagine having to flip through it to determine next steps during a crisis. DR documentation needs to be concise, scanable, and quickly understood to be effective. Visual-based documentation meets these requirements, so it’s no surprise that it also leads to higher DR success. DR success scores are based on: Meeting Recovery Time Objectives (RTO). Meeting Recovery Point Objectives (RPO). IT staff confidence in their ability to meet RTOs/RPOs. High DR Success Low Primarily flowcharts, checklists, and diagrams Traditional manual Source: Info-Tech Research Group, N = 95 Without question, 120-page DRPs are not effective. I mean, auditors love them because of the detail, but give me a 10-page DRP with contact lists, process flows, diagrams, and recovery checklists that are easy to follow. – Bernard Jones, MBCI, CBCP, CORP, Manager Disaster Recovery/BCP, ActiveHealth Management

4. Case Study: A telecom services provider is transforming a 4-binder BCP into a series of 1-page quick reference sheets • Cable and Wireless Communications provides telecom services to the Channel Islands. • Their Business Continuity Plan (BCP), which included DR procedures, was created by an outside contractor. The result was four binders of documentation. • During walkthroughs, the BCP was unworkable. It was too large and text heavy. Note: A BCP includes IT DR requirements. The same principals for effective documentation apply. Addressing IT DRP Requirements Results • They partnered with “Oliver & Company” to conduct a Business Impact Analysis to identify key processes and required services. • The team then created a dynamic Excel-based master plan, outlining applications and services that need to be recovered first, as well as data recovery requirements. • They are currently developing checklist-based recovery SOPs for each application. • Quick Start Guides and small action-orientated plans are transforming a bulky, unusable DRP into a modern, streamlined, actionable response. • They have moved from “if we have a disaster, we’ve got a rough idea of what to do, and then we’ll work it out,” to having actionable, planned incident response procedures that maximize recovery abilities. Transforming their BCP • Training and general education replace the teaching and explanation verbiage in their BCP that contributed to it being so bloated. • They are 90% finished providing each staff member with a one page Quick Start Guide that can be folded up and kept in their wallets with reminders, contacts, critical information, do’s and don’ts, and designated secondary work locations.

5. Use flowcharts for process flows, or a high-level view of more-detailed procedures Flowcharts provide an at-a-glance view, ideal for disaster scenarios where pressure is high and quick upward communication is necessary. Use swim lanes, as in this example, to indicate task ownership and process stages. For experienced staff, a high-level reminder of process flows or key steps is sufficient. Where more detail is required, include links to supporting documentation (which could include checklists, vendor documentation, other flowcharts, etc.). Download the template and example here: Flowchart SOP Template Example DRP Flowchart and SOPs(Zip file) Example: DRP in flowchart format We use flowcharts for our declaration procedures. Flowcharts are more effective when you have to explain status and next steps to upper management. –Assistant Director-IT Operations, Healthcare Industry

6. Use checklists to streamline step-by-step procedures Checklists are ideal when staff just need a reminder of what to do, not how to do it Remember your audience. You aren’t pulling in a novice to run a recovery script; you’re using IT staff experienced with the affected systems. Similarly, your Emergency Response Team (ERT) should be familiar with notification procedures through DR training and testing exercises, so a checklist is sufficient. Where more detail is required, include links to supporting documentation. Note that a flowchart can often be used instead of a checklist, depending on preference. Download the template here:Checklist SOP Template Example: DR Incident Assessment SOP (Zip file) in Checklist Format If your ERT and IT staff have not already walked through DR procedures, then you have a bigger issue than documentation. Regardless of your documentation approach, training and familiarity with relevant procedures is critical. Schedule tabletop planning and DR testing exercises to validate processes and ensure familiarity with DR procedures.

7. Use topology diagrams to capture network layout, integrations, and system information Organizations commonly have network topology diagrams for reference purposes, so this is just a re-use of existing resources. Topology diagrams, supplemented by key checklists and configuration settings, are often enough information for your experienced networking staff to carry out their DR tasks. If your topology diagrams are housed in a tool such as systems management product , then export the diagrams so they can be included in your DR documentation suite. Example: Network Topology Diagram Our network engineers came to me and said our standard SOP template didn't work for them. They're now using a lot of diagrams and flowcharts, and that has worked out better for them. – Assistant Director-IT Operations, Healthcare Industry

8. Avoid duplicating information; if it’s captured in a diagram or tool, bypass creating a separate traditional manual Keep the end goal in mind: enabling disaster recovery. Creating a pretty document for the sake of presentation won’t help you in a crisis. Info-Tech’s DR Planning and Monitoring Tool (see below) is a good example of a practical alternative to a formal document. It allows you to capture a step-by-step incident response plan, including timelines and task owners. Accompany the tool with a high-level flowchart if necessary for planning and presentation purposes, but bypass creating a traditional manual that would be redundant and less-effective. There would be little benefit, and a lot of unnecessary extra work, to duplicate this information in a formal document. Refer auditors and business leaders to this tool as evidence of a plan and the ability to manage that plan. • Download the tool here: DR Planning and Monitoring Tool(see Zip file).

9. Understand that a DRP is only as strong as the supporting documentation The DRP itself must focus on process and coordinating activities. As such, the DRP’s effectiveness depends on recovery procedures and other supporting documentation, as shown in the example below. This section will focus on the whole DR documentation suite. Leverage SOPs to reduce DR bottlenecks. Your key SMEs – your IT heroes – often become a bottleneck because they are depended on to execute many of the recovery procedures. SOPs, along with training, enable you to offload recovery tasks to other experienced staff and keep the DR process moving.

10. Include documentation requirements in project planning and performance appraisals to ensure SOPs are completed Documentation is a necessary evil — few like to create it and more-immediate tasks take priority — so if it isn’t scheduled, it won’t happen. Our directors and our CIO have tied SOP work to performance evaluations, and SOP status is reviewed during management meetings. People have now found time to get this work done. –Assistant Director-IT Operations, Healthcare Industry

11. Throw an SOP pizza party to put an immediate dent in yourhigh-priority SOPs backlog and build some momentum How to throw an SOP party Book a full-day meeting in an out of the way meeting room, invite key staff (system and process owners who ultimately need to be SOP owners), and order in lunch so no one has to leave. Set specific goals. e.g. Assign two top priority SOPs to each staff member to complete during the SOP party. Prioritize SOPs as follows: • Services/processes that are customer facing with either formal or informal SLAs. • Services/processes associated with mission critical systems/applications. • Services/processes done by senior staff that could be done by junior staff with some knowledge transfer. • Everything else. Repeat this on a monthly or quarterly basis, depending on your need, until all required SOPs are completed. The pizza party approach can add some levity to an exercise that is otherwise dry and will be met with resistance. • Why this works • “Locking” your team in a room helps everyone focus. If you let them work from their desks, other tasks and distractions can get in the way. • A group approach enables you to set expectations (e.g. visual-based approach, internal standards, level of detail) and promote consistency. • It’s easier to collaborate and leverage the expertise in the room so there are no delays seeking out people for missing information. • The importance of SOP work as a job requirement becomes ingrained; soon staff no longer need to be locked in a room to get this work done.

12. Use SOP parties and document reviews to facilitate process improvements Getting your processes down on paper shines a light on deficiencies that were previously ignored or not noticed Using SOP work to drive process improvement An important side-benefit to SOP writing is the inherent process review that takes place: When processes are documented for all to see, deficiencies become much more noticeable. Key staff who need to be involved in process review are already in the room. SOP writing turns into process improvement – an activity that presents more obvious benefits to staff and can further justify SOPs. • Keeping the team on track • Remember the first goal is to document current processes to ensure consistency and facilitate knowledge transfer. • Be prepared to park process improvement ideas for another SOP session if necessary to keep the team on track. • Document the potential issues or suggestions directly in the relevant SOP (e.g. use comments) so they are readily available for the next SOP review or refresh.